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LISTING OF THE CLAIMS : 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Claim 1 (Original) A method for analyzing a potential cause of a change in a service, wherein 
service quality of the service is monitored, usage of the service is measured, and service events 
are detected, the method comprising: 

determining a service change time window based at least in part upon a change in 
service quality between a first working state and a second, non-working state, and upon a change 
in service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a detected event and a time in which the event 

occurred; and 

computing a probability that the detected event caused the service change based at 
least in part on a correlation between the event time and the service change time window. 

Claim 2 (Original) The method of claim 1, wherein determining the service change time 
window comprises determining a service failure time window based upon the change in service 
quality and narrowing the service failure time window to the service change time window based 
upon the service usage amount measured during that service failure time window. 

Claim 3 (Original) The method of claim 2, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
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window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 

Claim 4 (Original) The method of claim 1, wherein computing the probability comprises 
computing the probability using at least in part a time weighting function which decreases 
exponentially with the distance between the event time and the service change time window. 

Claim 5 (Original) The method of claim 1, comprising determining whether one or more 
other events of a type identical to the detected event occurred, and wherein computing the 
probability comprises computing the probability using at least in part a false occurrence 
weighting function which decreases the probability of the detected event as the cause of the 
service change for instances in which the detected event occurred outside the service change time 
window. 

Claim 6 (Original) The method of claim 1, comprising storing historical data associating 
occurrences of prior events with prior service changes, and wherein computing the probability 
that the detected event caused the service change comprises computing the probability based at 
least in part on the historical data. 

Claim 7 (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events occurred within prior service change time 
windows, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a positive occurrence weighting function which increases 
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the probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event occurred within a 
prior service change time window. 

Claim 8 (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events were identified as having caused prior service 
changes, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a historical weighting function which increases the 
probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event was identified as 
having caused a prior service change. 

Claim 9 (Original) The method of claim 1, comprising retrieving data representing a plurality 
of detected events and corresponding event times, and wherein computing the probability 
comprises computing probabilities for each of the plurality of detected events. 

Claim 10 (Original) The method of claim 9, wherein computing probabilities comprises 
computing the probabilities such that the total of all computed probabilities is 1. 

Claim 1 1 (Original) The method of claim 1, wherein the service comprises service over a 
communication network and wherein the detected event comprises a network event. 
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Claim 12 (Original) The method of claim 1, wherein the service comprises service provided by 
an application program and wherein the detected event comprises an application program event. 

Claim 13 (Original) The method of claim 1, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service quality from the 
first working state to the second, non-working state. 

Claim 14 (Original) The method of claim 1, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service quality from the 
second, non-working state to the first, working state. 

Claim 15 (Original) The method of claim 1, wherein determining the service change time 
window comprises detecting a change in service quality by detecting a step change in measured 
usage. 

Claim 16 (Original) A method for analyzing potential causes of a service change, the method 
comprising: 

determining a service change time window encompassing a change of service 
between a first working state and a service outage, the service change being determined at least 
in part based on measured service usage levels; 

detecting occurrences of a set of events within a given time prior to and during the 
service change time window, each occurrence of an event being associated with a time at which 
the event occurred; and 
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computing a probability distribution for the set of events, which probability 
distribution determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations between the 
time of each event occurrence and the service change time window. 

Claim 17 (Original) The method of claim 16, wherein computing the probability distribution 
for the set of events comprises computing the probability distribution using a first weighting 
function which is the product of two or more second weighting functions. 

Claim 18 (Original) The method of claim 16, wherein the two or more second functions are 
selected from the group consisting of: 

a time weighting function which decreases exponentially the probability of a 
given event as the cause of the service change with the distance between the given event time 
and the service change time window; 

a false occurrence weighting function which decreases the probability of a given 
event as the cause of the service change for instances in which events of the same type as the 
given event occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability of a 
given event as the cause of the service change based on instances stored in a historical database 
in which events of the same type as the given event occurred within a prior service change time 
window; and 
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a historical weighting function which increases the probability of a given event as 
the cause of the service change based on instances in the historical database in which events of 
the same type as the given event were identified as having caused a prior service outage. 

Claim 19 (Original) The method of claim 1 8, wherein the step of computing the probability 
distribution comprises using a first weighting function which is the product of the time weighting 
function, false occurrence weighting function, positive occurrence weighting function, and user 
weighting function. 

Claim 20 (Original) The method of claim 16, comprising monitoring service quality, and 
wherein determining the service change time window comprises determining a service failure 
time window based upon a change in monitored service quality and narrowing the service failure 
time window to the service change time window based upon the service usage amount measured 
during that service failure time window. 

Claim 21 (Original) The method of claim 20, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 

Claim 22 (Original) The method of claim 16, comprising computing the probability 
distribution such that the total of all probabilities in the distribution is 1. 
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Claim 23 (Original) The method of claim 16, wherein the service comprises service over a 
communication network and wherein the detected events comprise network events. 

Claim 24 (Original) The method of claim 16, wherein the service comprises service provided 
by an application program and wherein the detected events comprise application program events. 

Claim 25 (Original) The method of claim 16, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service from the first 
working state to the second, non-working state. 

Claim 26 (Original) The method of claim 16, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service from the second, 
non-working state to the first, working state. 

Claim 27 (Currently Amended) The method of claim 4r 16, wherein determining the service 
change time window comprises detecting a step change in measured usage. 

Claim 28 (Original) A network monitoring system comprising: 

a service monitor for monitoring quality of service on the network; 
a usage meter for measuring usage of the network; 

an event detector for detecting network events and times at which the network 
events occur; and 
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a probable cause engine, coupled to receive data from the service monitor, usage 
meter, and the event detector, for: 

setting a service change time window based upon data received from the service 
monitor or usage meter, the service change time window encompassing at least part of an 
occurrence of a service outage in the network; and 

determining which of the network events detected by the event detector is the 
most likely cause of a service change based at least in part of the relations of the detected 
network event times to the service change time window. 

Claim 29 (Original) A computer readable medium storing program code for, when executed, 
causing a computer to perform a method for analyzing a potential cause of an change in a 
service, wherein service quality of the service is monitored, usage amount of the service is 
measured, and service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change in 
service quality between a first working state and a second, non-working state, and upon a change 
in service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a detected event and a time in which the event 

occurred; and 

computing a probability that the detected event caused the service change based at 
least in part on a correlation between the event time and the service change time window. 
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Claim 30 (Withdrawn) A method for quantifying the effect of an outage in a service over a first 
period of time, the method comprising: 

measuring usage of the service over time; 

defining a cost of outage time window comprising the first time period and a 
second time period following the first time period; and 

computing a cost of outage as the difference between the measured service usage 
during the cost of outage time window with service usage measured during a comparison 
window, the comparison window being substantially equal in time to that of the cost of outage 
time window and reflecting a similar period of service activity as that of the cost of outage time 
window without having a service outage. 

Claim 31 (Withdrawn) The method of claim 30, comprising determining the second period of 
time to be a time in which the measured service usage returns to within a given percentage of a 
normal service usage. 

Claim 32 (Withdrawn) The method of claim 30, comprising determining the second period of 
time to be the shorter of (1) a time in which the measured service usage returns to within a given 
percentage of a normal service usage and (2) a maximum time period. 

Claim 33 (Withdrawn) The method of claim 30, wherein computing the cost of outage 
comprises computing the difference in units of service usage. 
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Claim 34 (Withdrawn) The method of claim 33, wherein the service is a communication service 
conveying a plurality of messages, the method comprising computing the cost of outage in 
numbers of messages conveyed. 

Claim 35 (Withdrawn) The method of claim 33, wherein the service is a network server 
providing data items in response to requests therefor, the method comprising computing the cost 
of outage in numbers of requests received or data items provided by a server on the network. 

Claim 36 (Withdrawn) The method of claim 33, comprising converting the computed units of 
cost of service outage to a monetary value. 

Claim 37 (Withdrawn) The method of claim 36, wherein converting the computed units of cost 
of service outage comprises multiplying the units of cost of service outage by a first monetary 
value per unit of usage. 

Claim 38 (Withdrawn) The method of claim 30, comprising comparing the cost of outage to a 
second cost of outage value for a different service and prioritizing the outages based on the 
compared costs. 

Claim 39 (Withdrawn) The method of claim 30, comprising computing the difference between 
the monitored service usage following the cost of outage time window and a normal service 
usage level to thereby measure a long term effect of the service outage. 



{0022301 l.DOC;2} 



11 



Atty. Docket No. 600323-008 
PATENT 

Claim 40 (Withdrawn) A method for quantifying the effect of an outage in a service, the method 
comprising: 

measuring usage amounts of the service during a period of the service outage and 
a second period following the service outage; 

comparing the measured usage amounts to normal usage amounts measured under 
similar service conditions for a similar period of time where no service outage occurs; and 

determining a level of loss of service due to the service outage based on the 

comparison. 

Claim 41 (Withdrawn) The method of claim 40, comprising defining the second period as the 
shorter of a time period in which measured service usage amounts return to within a given range 
of normal usage amounts and a predefined maximum time period. 

Claim 42 (Withdrawn) The method of claim 40, wherein measuring service usage amounts 
comprises measuring service usage amounts in terms of units of service usage. 

Claim 43 (Withdrawn) The method of claim 42, wherein the service is a communication service 
conveying a plurality of messages, comprising measuring service usage amounts in terms of 
number of messages conveyed by the system. 

Claim 44 (Withdrawn) The method of claim 42, wherein the service is a network server 
providing data items in response to requests therefor, comprising measuring service usage 
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amounts in terms of numbers of requests received or data items provided by a server on the 
network. 

Claim 45 (Withdrawn) The method of claim 40, wherein determining the level of service loss 
comprises determining that substantially no loss of service occurred due to the outage based on 
the measured service usage amounts and normal service usage amounts being substantially 
equal. 

Claim 46 (Withdrawn) The method of claim 40, comprising: 

measuring service usage amounts during a third period following the second 

period; 

comparing the measured third period service usage amounts to normal usage 
amounts measured under similar service conditions for a similar period of time; and 

determining a long term effect on the service due to the service outage based on 
the comparison. 

Claim 47 (Withdrawn) A computer readable medium storing program code which, when 
executed, causes a computer to perform a method for quantifying the effect of an outage in a 
service over a first period of time, the method comprising: 
measuring service usage over time; 

defining a cost of outage time window comprising the first time period and a 
second time period; and 
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computing a cost of outage as the difference between the measured level of 
service usage during the cost of outage time window with a level of usage in a comparison 
window, the comparison window being substantially equal in time to the cost of outage time 
window and reflecting a similar period of service activity as the cost of outage time window 
without having a service outage. 

Claim 48 (Withdrawn) A method for predicting a cost of an outage of a service, the method 
comprising: 

measuring time duration for and service usage during the outage; 

comparing the measured usage amounts to normal usage amounts measured under 
similar service conditions for a similar period of time where no service outage occurs, to thereby 
determine a usage loss amount; and 

computing a predicted cost of the outage based at least upon a cost component, 
the cost component comprising a function of the measured time of the outage and measured 
usage loss amount. 

Claim 49 (Withdrawn) The method of claim 48, comprising measuring service usage on an 
ongoing basis and detecting the onset of the service outage using the measured service usage. 

Claim 50 (Withdrawn) The method of claim 49, wherein detecting the onset of the service 
outage comprises detecting a step change in service usage. 
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Claim 5 1 (Withdrawn) The method of claim 48, comprising monitoring quality of the service 
and detecting the onset of a service outage based upon the service quality. 

Claim 52 (Withdrawn) The method of claim 51, wherein monitoring service quality comprises 
monitoring service quality through periodic polling of the service quality, and wherein detecting 
the onset of a service outage comprises detecting the outage onset as bounded by a polled point 
of a first, working state and a polled point of a second, non-working state. 

Claim 53 (Withdrawn) The method of claim 48, wherein computing the predicted cost of the 
outage comprises using a service demand cost component representing an affect on service usage 
based upon the duration of an outage. 

Claim 54 (Withdrawn) The method of claim 53, wherein using the service demand cost 
component comprises multiplying the measured usage loss by a usage loss curve which is a 
function of time duration of an outage and represents a predicted percentage usage due to an 
outage based on time duration of the outage. 

Claim 55 (Withdrawn) The method of claim 54, comprising generating the usage loss curve 
using historical data derived from prior service outages. 

Claim 56 (Withdrawn) The method of claim 48, wherein computing the predicted cost of the 
outage comprises using a customer retention cost component representing a number or 
percentage of customers lost due to the outage. 
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Claim 57 (Withdrawn) The method of claim 48, wherein computing the predicted cost of the 
outage comprises using an agreement penalty component representing penalties arising under 
one or more service agreements due to a service outage. 

Claim 58 (Withdrawn) The method of claim 48, wherein computing the predicted cost of the 
outage comprises computing the cost in units of service usage. 

Claim 59 (Withdrawn) The method of claim 58, comprising converting the computed units of 
predicted cost to a monetary value by multiplying the units of predicted cost by a first monetary 
value per unit of usage. 

Claim 60 (Withdrawn) The method of claim 48, comprising comparing the predicted cost of 
service outage to a second predicted cost of outage value for a different service and prioritizing 
the outages based on the compared costs. 

Claim 61 (Withdrawn) A network monitoring system comprising: 

a usage meter for measuring usage of a service on the network; 

an event detector for detecting network events and times at which the network 

events occur; 

a probable cause engine, coupled to receive data from the usage meter and the 
event detector, for determining which of the network events detected by the event detector is the 
most likely cause of a service outage based at least in part of the relations of the detected 
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network event times to a service change time window, the service change time window 
encompassing at least part of an occurrence of the service outage in the network; and 

a costing engine, coupled to receive data from the usage meter, for predicting the 
cost of the service outage. 

Claim 62 (Previously added) Computer readable media comprising program code that, when 
executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for analyzing potential cause of a service change, the method comprising: 

determining a service change time window encompassing a change of service 
between a first working state and a service outage, the service change being determined at least 
in part based on measured service usage levels; 

detecting occurrences of a ser of events within a given time prior to and during 
the service change time window, each occurrence of an event being associated with a time at 
which the event occurred; and 

computing a probability distribution for the set of events, which probability 
distribution determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations between the 
time of each event occurrence and the service change window. 

Claim 63 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
computing the probability distribution for the set of event comprises computing the probability 
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distribution using a first weighting function which is the product of two or more second 
weighting functions. 

Claim 64 (Previously added) The computer readable media comprising program code of claim 
63 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the two or more second functions are selected from the group consisting of: 

a time weighting function which decreases the probability of a given event 
as the cause of the service change with the distance between the given event time and the service 
change time window; 

a false occurrence weighting function which decreases the probability of a 
given event as the cause of the service change for instances in which events of the same type as 
the given event occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability 
of a given event as the cause of the service change based on instances stored in a historical 
database in which events of the same type as the given event occurred within a prior service 
change time window; and 

a historical weighting function which increases the probability of a given 
event as the cause of the service change based on instances in the historical database in which 
events of the same type as the given event were identified as having caused a prior service 
outage. 



{0022301 l.DOC;2} 



18 



Atty. Docket No. 600323-008 
PATENT 

Claim 65 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising monitoring service quality, an wherein determining the service change time 
window comprises determining a service failure time window based upon a change in monitored 
service quality and narrowing the service failure time window to the service change time window 
based upon the service usage amount measured during the service failure time window. 

Claim 66 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising computing the probability distribution such that the total of all probabilities 
in the distribution is 1 . 

Claim 67 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service comprises service over a communication network and wherein the detected events 
comprise network events. 

Claim 68 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
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the service comprises service provided by an application program and wherein the detected 
events comprise application program events. 

Claim 69 (Previously added) The computer readable media comprising program code of claim 
62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service change is a service outage, comprising determining the service change time window 
as a change in service from the first working state to the second, non-working state. 

Claim 70 (Withdrawn) Computer readable media comprising program code that, when executed 
by a programmable microprocessor, causes the programmable microprocessor to execute a 
method for quantifying the effect of an outage in a service, the method comprising: 

measuring usage amount of the service during a period of the service 
outage and a second period following the service outage; 

comparing the measured usage amounts to normal usage amounts 
measured under similar service conditions for a similar period of time where no service outage 
occurs; and 

determining a level of loss of service due to the service outage based on 
the comparison. 

Claim 71 (Withdrawn) The computer readable media of claim 70 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, the method comprising 
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defining the second period as the shorter of a time period in which measured service usage 
amounts return to within a given range of normal usage amounts and a predefined maximum 
time period. 

Claim 72 (Withdrawn) The computer readable media of claim 70 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, wherein measuring service 
usage amounts comprises measuring service usage amounts in terms of units of service usage. 

Claim 73 (Withdrawn) The computer readable media of claim 72 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, wherein the service is a 
communications service conveying a plurality of messages, comprising measuring service usage 
amounts in terms of number of messages conveyed by the system. 

Claim 74 (Withdrawn) The computer readable media of claim 72 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, wherein the service is a 
network server providing data items in response to requests therefore, comprising measuring 
service usage amounts in terms of number of requests received or data items provided by a server 
on the network. 
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Claim 75 (Withdrawn) The computer readable media of claim 70 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, wherein determining the 
level of service loss comprises determining that substantially no loss of service occurred due to 
the outage based on the measured service usage amounts and normal service usage amounts 
being substantially equal. 

Claim 76 (Withdrawn) The computer readable media of claim 70 comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for quantifying the effect of an outage in a service, the method comprising: 
measuring service usage amounts during a third period following the 

second period; 

comparing the measured third period service usage amounts to normal 
usage amounts measured under similar conditions for a similar period of time; and 

determining a long term effect on the service due to the service outage 
based on the comparison. 

Claim 77 (Withdrawn) Computer readable media comprising program code that, when executed 
by a programmable microprocessor, causes the programmable microprocessor to execute a 
method for predicting a cost of an outage of a service, the method comprising: 

measuring time duration for and service usage during the outage; 

comparing the measured usage amounts to normal usage amounts 
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measured under similar service conditions for s similar period of time where no service outage 
occurs, to thereby determine a usage loss amount; and 

computing a predicted cost of the outage based at least upon a cost 
component, the cost component comprising a function of the measured time of the outage and 
measured usage loss amount. 
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